BREAKING
Two Big States, One January 1 Deadline: Delaware and California Compliance Obligations for 2027
January 1, 2027 is the shared operative date for several Delaware and California compliance changes. Delaware HB 380 revises privacy obligations. California SB 1050, SB 1237, and the operative contract-date provisions of AB 1697 create separate advertising, reporting, and employment-contract duties. This article provides general compliance information, not legal advice.
The common date creates a registration requirement. Each obligation requires its own citation, owner, triggering event, and compliance evidence. A single “January privacy update” project does not establish sufficient control.
What Is Changing in Delaware
Delaware HB 380 amends the Delaware Personal Data Privacy Act. The measure was signed on September 2, 2026, as Volume 85, Chapter 463. It becomes effective on January 1, 2027.
The amendments lower the applicability threshold from 35,000 consumers to 10,000 consumers. The data-sale revenue prong uses a 5,000-consumer threshold.
The law narrows certain Gramm-Leach-Bliley Act exemptions. It expands sensitive data categories and adds third-party due diligence and contracting duties. It also lowers the assessment threshold to 50,000 consumers and adds profiling impact assessments.
Consumer rights are expanded. Organizations within scope must therefore review privacy notices, consumer request workflows, opt-out handling, vendor contracts, assessment procedures, and evidence controls.
The required work is not limited to updating a public notice. It includes scope verification, data mapping, third-party review, contract language, impact assessment controls, and defensible records of each completed action.
The state-law tracker provides a controlled location for monitoring state obligations and operative dates.
What Is Changing in California
California has three separate measures with January 1, 2027 compliance significance. Each measure addresses a different operational function.
SB 1050
California SB 1050 was signed on September 16, 2026, as Chapter 246. It is operative on January 1, 2027.
The measure adds Business and Professions Code Section 17610. It requires a clear and conspicuous disclosure in advertisements that prominently feature synthetic performers. The disclosure must use specified wording.
Marketing, advertising, legal, and compliance owners should register this as an advertising review obligation. The relevant evidence includes the reviewed advertisement, the disclosure approval, the applicable version of the advertisement, and the review date.
The obligation applies to the advertisement workflow. It should not be combined with privacy notice work merely because both involve technology or synthetic content.
AB 1697
California AB 1697 is an urgency statute that became effective on September 30, 2026, as Chapter 889. Its revised stay-or-pay prohibitions apply only to contracts entered into on or after January 1, 2027.
Conduct from 2026 is inoperative under the enacted change. Related claims are moot. The measure also expands the applicable exceptions.
The January 1 date is therefore a contract-entry trigger rather than the statute’s effective date. Human resources, procurement, legal, and operations teams should register the contract review separately.
Evidence should show the contract date, the applicable version, the review outcome, and any documented exception. The register should preserve the distinction between the September 30 effective date and the January 1 contract-date rule.
SB 1237
California SB 1237 was chaptered on September 30, 2026, as Chapter 1019. The relevant provision is operative on January 1, 2027.
The measure raises the penalty for a subsequent pay data reporting failure from $200 to up to $1,000 per employee. The penalty for a first failure remains $100 per employee.
The May 2027 reporting cycle is the first filing cycle exposed to the higher subsequent-failure penalty. The reporting owner should register the filing deadline, required data, review approval, submission confirmation, and retained filing evidence.
A reporting calendar alone does not prove compliance. The evidence package should establish what was submitted, when it was submitted, who approved it, and which records support the filing.
Why One Date Across Several Laws Is a Registration Problem
A shared operative date creates simultaneous obligations, not one consolidated obligation.
Delaware requires a privacy scope review, updated privacy controls, third-party diligence, contract review, assessments, and consumer-rights readiness. California requires advertisement disclosures, contract-date controls, and pay data reporting controls.
These obligations have different:
- Legal citations.
- Applicability thresholds.
- Triggering events.
- Responsible owners.
- Required notices or filings.
- Evidence types.
- Retention periods.
- Review cadences.
The correct control structure registers each requirement separately. A privacy notice, vendor agreement, impact assessment, advertising disclosure, and reporting filing should not appear as one general task.
This approach supports accurate regulatory requirements by state and clarifies which state notice requirements apply to each process. It also preserves compliance evidence for later review.
The Obligations Most Likely to Create Notice and Evidence Duties
Privacy notice
A Delaware privacy notice should reflect the organization’s applicability determination and the expanded consumer rights that apply from January 1, 2027.
Evidence artifact: Approved notice version, publication date, scope review, approval record, and archived prior version.
Consumer opt-out
Expanded consumer rights require a controlled process for receiving, authenticating, routing, and completing applicable requests or opt-outs.
Evidence artifact: Request log, intake date, identity review, action taken, completion date, exception record, and system confirmation.
Vendor or processor contract
Delaware adds third-party due diligence and contracting duties. Vendor records should show how the organization assessed the relationship and addressed required terms.
Evidence artifact: Due diligence checklist, vendor classification, executed contract, approved clauses, review date, and remediation record.
Impact assessment
The Delaware assessment threshold is lowered to 50,000 consumers. Profiling impact assessments are added.
Evidence artifact: Completed assessment, scope statement, data categories reviewed, profiling activity if applicable, identified risks, approval, and review date.
Reporting filing
California SB 1237 increases exposure for a subsequent pay data reporting failure. The May 2027 cycle requires a documented filing control.
Evidence artifact: Reporting dataset, validation record, approval record, submission confirmation, filing date, and retained copy of the submitted report.
These artifacts form the basis of compliance notice requirements and broader compliance evidence. They also allow the organization to distinguish a completed obligation from an unverified task.
A Register Entry Checklist for a New State Obligation
Each new entry should contain the following fields:
Citation and chapter
Record the bill number, statutory citation when provided, chapter number, and official source.Effective and operative dates
Separate the date a measure becomes effective from the date a provision applies to conduct, contracts, filings, or other triggering events.Applicability threshold
Record consumer thresholds, revenue prongs, covered contracts, advertising conditions, or reporting conditions.Triggering event
Identify the event that starts the obligation. Examples include processing data, entering a contract, publishing an advertisement, receiving a request, or submitting a report.Owner
Assign a named business function. Privacy, legal, human resources, marketing, regulatory affairs, and operations may hold different obligations under the same state.Required notices or filings
Identify each privacy notice, consumer response, advertising disclosure, contract provision, assessment, or government filing.Evidence produced
Specify the record that proves completion. Avoid generic entries such as “compliance completed.”Retention
Establish how long the notice, contract, assessment, request log, filing, approval, or submission confirmation remains available.Review cadence
Set a review interval and a review trigger. Relevant triggers include a statutory amendment, material process change, new vendor, new data use, revised advertisement, or upcoming filing cycle.
Three Pitfalls in Multi-State Year-End Rollouts
Treating a shared date as one project
A shared date does not create shared requirements. Combining unrelated work hides ownership and prevents precise evidence collection.
Recording the effective date but not the trigger
AB 1697 demonstrates the distinction. The statute became effective on September 30, 2026, but the revised prohibition applies to contracts entered into on or after January 1, 2027. The register must retain both dates and the contract-entry trigger.
Completing the control without preserving the record
A revised notice, approved contract, completed assessment, or submitted report requires an archived record. Screenshots, approval logs, dated versions, and submission confirmations preserve defensible evidence.
State notice requirements should therefore be managed with the same discipline as filings and assessments. The objective is not only to complete the action. The objective is to demonstrate what applied, who acted, when the action occurred, and what record remains.
Frequently Asked Questions
What is the main January 1, 2027 compliance issue?
Several separate Delaware and California obligations become operative or apply to covered conduct on January 1, 2027. They should be registered as separate entries.
Does Delaware HB 380 only require a privacy notice update?
No. The amendments affect scope, GLBA exemptions, sensitive data, third-party diligence, contracting, assessments, profiling impact assessments, and consumer rights.
When should California AB 1697 contracts be reviewed?
Contracts entered into on or after January 1, 2027 require review under the revised stay-or-pay provisions. The statute itself became effective on September 30, 2026.
When is the higher California pay data penalty relevant?
The May 2027 reporting cycle is the first filing cycle exposed to the higher penalty for a subsequent failure. The first-failure penalty remains $100 per employee.
What proves that an obligation was completed?
The evidence depends on the obligation. It may include an approved notice, request log, executed contract, assessment, advertisement review, filing confirmation, or dated approval record.
Next Step
Register each Delaware and California obligation with its citation, chapter, date, threshold, trigger, owner, evidence artifact, retention rule, and review cadence. The registration management service supports structured obligation tracking and defensible records. Related notice workflows are available through electronic notices.